Proposed Anti-Piracy Legislation
A new anti-piracy bill designated as H.R. 10364, or the American Copyright Protection Act of 2026 (ACPA), has been introduced in the U.S. Congress. It would require internet service providers, DNS resolving services, and virtual private networks to block foreign websites or services hosting pirated content. The bill targets foreign services affecting connections originating from the United States, presenting immediate complications when VPNs and content delivery networks are utilized.
Under the proposed framework, a standard blocking order requires court approval and would apply within 14 to 30 days. However, a special provision targets time-sensitive events like live sports streaming, shortening the compliance timeline at a judge's discretion provided the initial copyright leak appears within 24 hours of going live.
ISP and DNS level blocking remains relatively straightforward for users relying on default network providers. Conversely, users utilizing external DNS resolution services such as Google DNS, Cloudflare, OpenDNS, or NextDNS could also face filtered resolution requests originating from domestic users, depending on geolocation accuracy.
Exemptions and Ambiguities
Small ISPs, public networks, and services managing fewer than 100,000 monthly users are exempted from the mandate, alongside root DNS and top-level domain providers. The legislation does not specify exact blocking methodologies, raising concerns that providers might adopt overly broad restrictions to mitigate liability risks. The text also omits protections for encryption protocols.
VPN and Routing Complications
Enforcement becomes increasingly complex for VPN users because the bill fails to define terms like originating from the United States or establishing what constitutes a foreign entity. Several technical scenarios highlight these ambiguous parameters:
A connection to a VPN originates from the United States.
A VPN endpoint resides within U.S. borders.
A registered VPN subscriber is a U.S. person currently located outside the country.
A user connects via VPN to a foreign country while accessing a website operating behind a content delivery network.
A target website is hosted on U.S. soil despite being accessed from an external location.
Multi-hop VPN configurations route traffic through domestic nodes at various stages.
A U.S. citizen in international waters utilizes a domestic satellite internet provider like Starlink.
A U.S. citizen travels abroad and uses cellular roaming infrastructure tied to domestic networks.
Technical Hurdles
Additional legal questions emerge from technologies like shared hosting IP addresses, carrier-grade network translation, Oblivious DoH, and Apple's iCloud Private Relay, all of which obscure connection endpoints and traffic destinations. Encrypted DNS further limits an ISP's visibility into specific domains requested by users.
International Precedents
Similar legislative pressure in France and Spain has challenged the liability of third-party intermediaries. Courts in those regions ruled against network neutrality claims, forcing entities like Cloudflare and various VPN providers to comply with broad blocking mandates that frequently result in false positives.
The ACPA currently remains one of multiple bills introduced in Congress without confirmed sponsors, scheduled hearings, or committee markups, though critics warn that expansive enforcement could produce significant unintended technological consequences.
